CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1777 – Agent names disclosed in chat feature
https://notcve.org/view.php?id=CVE-2020-1777
Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions. Los nombres de los agentes que participan en una conversación de chat se revelan en determinadas partes de la interfaz externa, así como en las transcripciones de chat dentro de los tickets, cuando el sistema está configurado para enmascarar los nombres reales de los agentes. Este problema afecta a OTRS; versiones 7.0.21 y anteriores, versiones 8.0.6 y anteriores • https://otrs.com/release-notes/otrs-security-advisory-2020-15 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-1776 – Invalidating or changing user does not invalidate session
https://notcve.org/view.php?id=CVE-2020-1776
When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions. Cuando un usuario de agente es renombrado o se establece como no válido, la sesión que pertenece al usuario se mantiene activa. • https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html https://otrs.com/release-notes/otrs-security-advisory-2020-13 • CWE-613: Insufficient Session Expiration •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1775 – Information disclosure in external interface
https://notcve.org/view.php?id=CVE-2020-1775
BCC recipients in mails sent from OTRS are visible in article detail on external interface. This issue affects OTRS: 8.0.3 and prior versions, 7.0.17 and prior versions. Los destinatarios de BCC en los correos enviados desde OTRS son visibles en los detalles del artículo en la interfaz externa. Este problema afecta a OTRS: versiones 8.0.3 y anteriores, versiones 7.0.17 y anteriores • https://otrs.com/release-notes/otrs-security-advisory-2020-12 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.9EPSS: 0%CPEs: 4EXPL: 0CVE-2020-1774 – Information disclosure
https://notcve.org/view.php?id=CVE-2020-1774
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions. Cuando el usuario descarga claves y certificados de PGP o S/MIME, el archivo exportado presenta el mismo nombre para las claves privadas y públicas. • https://lists.debian.org/debian-lts-announce/2020/05/msg00000.html https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html https://otrs.com/release-notes/otrs-security-advisory-2020-11 • CWE-201: Insertion of Sensitive Information Into Sent Data •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-1773 – Session / Password / Password token leak
https://notcve.org/view.php?id=CVE-2020-1773
An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to predict other users session IDs, password reset tokens and automatically generated passwords. This issue affects ((OTRS)) Community Edition: 5.0.41 and prior versions, 6.0.26 and prior versions. OTRS; 7.0.15 and prior versions. Un atacante con la capacidad de generar ID de sesión o tokens de restablecimiento de contraseña, ya sea mediante la autenticación o la explotación de OSA-2020-09, puede predecir ID de sesión de otros usuarios, tokens de restablecimiento de contraseña y contraseñas generadas automáticamente. Este problema afecta a ((OTRS)) Community Edition: versiones 5.0.41 y versiones anteriores, versiones 6.0.26 y versiones anteriores. • http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00066.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00077.html https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html https://otrs.com/release-notes/otrs-security-advisory-2020-10 • CWE-331: Insufficient Entropy •